The cryptocurrency exchange says attackers may have exploited an employee’s compromised laptop to initiate unauthorized withdrawals. About $3 billion in affected assets has been frozen, and Binance promises to cover customer losses.
Binance, the world’s largest cryptocurrency exchange by trading volume, has reported a major security breach with an estimated impact of $6.3 billion, triggering an international effort to freeze digital assets and protect customers. The incident emerged Thursday, October 29, 2026, when suspicious transactions were detected involving wallets connected to the exchange.
Stablecoin issuers Tether and Circle moved quickly to block more than $2.3 billion in cryptocurrency associated with the suspected attack. Binance later confirmed that approximately $3 billion in affected assets had been frozen through coordinated efforts involving blockchain companies and law enforcement.
The exchange temporarily suspended deposits and withdrawals while investigators examined the breach and secured its systems. Binance assured customers that their funds remained safe and promised to cover any losses resulting from the incident.
In an official security update dated October 30, Binance said its preliminary findings pointed to a compromised laptop belonging to a development operations engineer. Investigators believe an attacker may have used that access to enter a service container and submit unauthorized withdrawal transactions.
The company emphasized that its findings remained preliminary and that it had discovered no evidence of wallet private keys being leaked. The exact amount of permanently lost cryptocurrency and the identity of those responsible have not been established.
Tether and Circle Freeze Billions in Cryptocurrency
The response involved two of the largest companies issuing stablecoins, digital currencies designed to maintain a relatively steady value. Tether issues USDT, while Circle issues USDC, both of which are intended to track the value of the U.S. dollar.
Tether CEO Paolo Ardoino announced that his company had frozen approximately $1.57 billion in USDT associated with the suspicious Binance transactions. Circle CEO Jeremy Allaire confirmed that his company had frozen more than $800 million in USDC while coordinating with law enforcement.
Together, those actions accounted for approximately $2.37 billion in frozen assets. Additional restrictions imposed by Binance and other blockchain partners brought the reported total to approximately $3 billion.
Earlier reports placed the frozen amount at $2.54 billion, but that figure increased as investigators identified additional assets. The changing totals reflect an ongoing recovery effort rather than conflicting estimates of a single completed operation.
Unlike Bitcoin and many other cryptocurrencies, centralized stablecoins can include technical controls that allow their issuers to restrict transfers involving particular addresses. These capabilities can help investigators prevent suspected stolen tokens from moving further through blockchain networks.
However, freezing cryptocurrency does not necessarily mean the original owner has recovered it. The assets may remain inaccessible while investigators determine ownership, evaluate transactions and pursue legal procedures for returning funds.
The cryptocurrency industry’s response shows how cooperation among exchanges, token issuers and blockchain investigators can limit losses after a suspected theft. It also illustrates the challenges of tracking assets that can move rapidly between different digital wallets and trading platforms.
How the Suspected Binance Attack Happened
Binance’s preliminary investigation identified a possible entry point involving a laptop used by one of its development operations engineers. These employees typically help maintain the software systems and infrastructure needed to keep large technology platforms operating.
According to the company’s October 30 announcement, the compromised device may have allowed an attacker to access a service container within Binance’s systems. Unauthorized withdrawal transactions were then reportedly submitted through that access.
The company did not explain precisely how the laptop became compromised or what security protections may have failed. It also said investigators had found no evidence that the private keys controlling cryptocurrency wallets had been exposed.
That distinction matters because private keys provide direct control over cryptocurrency stored at particular blockchain addresses. A breach involving internal transaction systems could allow unauthorized activity without requiring an attacker to steal the keys themselves.
Reports initially focused on unusually large transfers involving Binance hot wallets, which are cryptocurrency wallets connected to the internet. Exchanges use these wallets to process customer withdrawals and other transactions efficiently.
Cold wallets, by comparison, store the information needed to control cryptocurrency offline and are generally less exposed to internet-based attacks. Exchanges commonly use a combination of hot and cold storage to balance transaction speed with security.
Blockchain analysts identified billions of dollars in suspicious movements as the incident developed. Their estimates varied because transactions continued to move across addresses and investigators had not yet established which transfers represented confirmed losses.
Binance Suspends Withdrawals and Promises Reimbursement
Binance responded by temporarily suspending deposits and withdrawals while its security teams investigated. The company also revoked affected address authorizations and contacted law enforcement and blockchain intelligence specialists to trace the transactions.
In its official statement, Binance said it would cover losses using its Secure Asset Fund for Users, commonly known as SAFU, alongside company funds. The fund was established to provide financial protection for users during certain emergencies.
Binance co-founder Yi He also promised that the company would cover losses associated with the attack. The exchange has not yet provided a complete accounting of how much money will be required or when normal transactions will fully resume.
Its assurance that customer assets remain safe is a company statement rather than an independently completed assessment of its financial position. Binance said it would publish an updated proof-of-reserves report after security work was completed.
A proof-of-reserves report provides information about cryptocurrency holdings used to support customer balances. Such reports can help customers evaluate exchange reserves, although their reliability depends on the scope and methods used.
The company also warned customers to avoid suspicious messages and unofficial websites claiming to provide information about the incident. Criminals sometimes exploit major security breaches by sending fraudulent recovery instructions designed to steal passwords or account credentials.
Cryptocurrency Markets React to Security Fears
News of the suspected attack triggered selling across major cryptocurrency markets as traders assessed the potential financial damage. Bitcoin fell more than 3% during Thursday’s trading and dropped below $79,000, according to The Associated Press.
Other major cryptocurrencies also declined as uncertainty spread through the digital asset industry. Reuters reported that investors were concerned about the possible consequences for centralized exchanges and the companies that depend on them.
If the estimated $6.3 billion impact represents a confirmed theft, the incident would exceed previously reported cryptocurrency hacking losses. However, the amount ultimately stolen and not recovered remains uncertain.
The incident also comes after several major security breaches involving cryptocurrency companies. In February 2025, the exchange Bybit suffered a theft estimated at approximately $1.5 billion, which investigators linked to North Korean hackers.
Coinbase disclosed a separate security incident in May 2025 involving customer information obtained through individuals working with outside support operations. Attackers demanded $20 million, but Coinbase said it would not pay the ransom.
These incidents involved different methods and circumstances, underscoring the variety of risks facing cryptocurrency platforms. Some attacks target wallet systems directly, while others rely on compromised employees, stolen information or weaknesses in connected services.
Changpeng Zhao’s Legal History Draws Renewed Attention
The Binance incident has also renewed public attention on the company’s founder, Changpeng Zhao, widely known as CZ. Zhao established Binance in 2017 and helped build it into one of the world’s largest cryptocurrency trading platforms.
In November 2023, Zhao pleaded guilty to violating U.S. anti-money-laundering requirements and resigned as Binance CEO. The company also reached a multibillion-dollar settlement with American authorities over failures involving financial compliance and sanctions controls.
Zhao was sentenced to four months in federal prison in 2024 and was released later that year. President Donald Trump pardoned him in October 2025, a decision that attracted scrutiny because of financial relationships involving cryptocurrency businesses associated with the Trump family.
Zhao no longer manages Binance’s daily operations, although he remains a shareholder. After reports of the suspected breach emerged, he said the incident appeared to involve hacking and expressed confidence that affected customers would be reimbursed.
His previous criminal case involved financial compliance failures, not allegations that he participated in the October 2026 security breach. There is no verified evidence connecting Zhao’s earlier legal violations to the method used in the reported attack.
Investigation Continues as Binance Works to Recover Assets
Binance is cooperating with law enforcement and blockchain intelligence companies to identify the attackers and recover affected assets. Its security teams are also reviewing internal infrastructure and transaction permissions to determine how unauthorized activity became possible.
The company has promised to publish a technical report once investigators have established the facts. That report is expected to address the attack’s entry point, the systems affected and the measures taken to prevent similar incidents.
For customers, the most immediate concerns remain access to their accounts, the safety of their holdings and the timetable for restoring normal services. Binance has not announced a confirmed date for lifting all transaction restrictions.
The exchange has reported approximately $3 billion in frozen assets against an estimated $6.3 billion impact, leaving substantial questions about the remaining funds. Its next major steps will involve tracing those assets, completing its investigation and demonstrating that customer balances are fully protected.
IMAGE: Source Own work using: https://kriptoborsalari.com/borsalar/binance Author Kripto Borsaları CC0